Supply Chain Cyber Risk: What UK CISOs Must Own Now

Supply chain cyber attacks now account for approximately 30% of all UK cyber incidents, according to Howden and Risk Ledger’s 2026 analysis. The operational disruption caused by the Synnovis ransomware attack in 2024 — which affected NHS blood supply across London — and the MOVEit file transfer vulnerability in 2023, which compromised data across hundreds of organisations simultaneously, have made third-party ICT risk one of the most urgent items on any CISO’s security agenda. The Cyber Security and Resilience Act, which received Royal Assent in May 2026, formalises these obligations in UK law.

Why Is Supply Chain Cyber Risk a CISO Priority in 2026?

Third-party cyber incidents have a defining characteristic that makes them structurally different from direct attacks: your organisation suffers the consequences of a security failure it did not cause and cannot directly prevent. The NHS 111 disruption caused by the Advanced ransomware attack in 2022, the Synnovis attack of 2024 and the cascading MOVEit exploitation all demonstrate that the blast radius of a single supplier’s security failure can affect hundreds of downstream organisations simultaneously.

Risk Ledger’s 2026 analysis found that approximately one in three UK cyber incidents now originates in the supply chain. The same research highlights that many organisations have limited visibility into the security posture of their second and third-tier suppliers — the subcontractors and technology providers that underpin their critical suppliers — leaving material exposure that is neither monitored nor mitigated.

For UK CISOs and Chief Risk Officers, the governance obligation is clear: supply chain cyber risk must be owned at executive level, not treated solely as a procurement or IT matter. The UK Corporate Governance Code 2024’s emphasis on board ownership of material risks, the forthcoming Cyber Security and Resilience Bill’s requirements for critical sectors, and DORA’s ICT third-party risk framework for financial services organisations all point in the same direction. This is an executive risk that demands CISO ownership, not just a technology matter.

Executive Action

• Commission an immediate review of your top 20 critical suppliers to establish their cybersecurity posture — understand their incident response capability, their own supply chain dependencies and their contractual obligations to you in the event of a breach.
• Ensure your board risk register explicitly includes supply chain cyber risk as a named category with an identified owner, documented controls and a defined risk appetite statement.
• Review your cyber insurance policy to confirm coverage extends to supply chain-originated incidents — many policies contain exclusions or sub-limits that may leave you underinsured for the most likely attack vector.

What Does the Cyber Security and Resilience Bill Mean for UK CISOs?

The Cyber Security and Resilience Bill, announced in the King’s Speech 2024 and progressing through Parliament, will significantly expand the scope of UK cyber regulation. Its central purpose is to update and extend the Network and Information Systems (NIS) Regulations 2018, bringing more sectors and more organisations within the mandatory cyber resilience framework, and specifically addressing supply chain risk as a regulated obligation.

The Bill is expected to extend mandatory cyber resilience requirements to a broader range of digital services and managed service providers — precisely the category of organisations most frequently implicated in supply chain attacks. It will also increase the ICO’s information-gathering powers and strengthen reporting obligations for significant cyber incidents. For security leaders in regulated sectors, this means the supply chain security standards your organisation applies to its suppliers will be subject to regulatory scrutiny, not just internal governance.

CISOs should also note the interaction with DORA — the EU Digital Operational Resilience Act, which came into force in January 2025. UK financial services organisations with EU operations or EU client relationships must comply with DORA’s ICT third-party risk requirements, which mandate formal ICT service provider registers, contractual minimum standards, concentration risk management and regular resilience testing. Even for purely UK-focused financial services firms, DORA represents the direction of travel for UK regulatory expectations under the Cyber Security and Resilience Bill.

Executive Action

• Brief your board on the Cyber Security and Resilience Bill’s likely scope and timeline — ensure directors understand the regulatory obligations that are coming and the governance uplift required to meet them.
• If your organisation operates in financial services with any EU nexus, conduct a DORA ICT third-party risk gap assessment now — the contractual and operational requirements are substantial and require advance planning to implement.
• Engage with your sector’s industry body to understand the specific guidance being developed for your sector under the Cyber Security and Resilience Bill’s implementation framework.

How Should CISOs Structure Third-Party ICT Risk Governance?

Effective supply chain cyber governance requires a structured framework that goes beyond standard procurement due diligence. The risk is not static — suppliers change their own technology stack, subcontract to new providers and experience their own security incidents — so point-in-time assessments at contract signing are insufficient. CISOs need a continuous monitoring capability, a tiered supplier risk classification system and clear escalation paths for material supply chain incidents.

A DORA-aligned approach to ICT third-party risk governance provides a robust framework even for organisations outside the financial services sector. The core elements are: a comprehensive ICT service provider register identifying all third parties with access to your systems or data; contractual minimum security standards including audit rights, incident notification timelines and sub-contractor controls; a concentration risk assessment identifying which suppliers represent single points of failure; and a resilience testing programme that includes supply chain scenarios.

For critical suppliers — those whose failure or compromise would cause material operational disruption — CISOs should require independent cyber security certifications such as Cyber Essentials Plus or ISO 27001, mandate right-to-audit provisions in contracts, and establish direct reporting lines for security incidents that bypass commercial relationship managers. INFORMD’s supply chain risk assessment tools and third-party risk governance templates can help CISOs structure these requirements efficiently.

Executive Action

• Build a complete ICT service provider register — document every third party with access to your systems, data or operational processes, classified by criticality tier, and reviewed by the CISO and risk committee annually.
• Implement minimum contractual cyber security standards for all critical suppliers — including incident notification within 24 hours, right to audit, sub-contractor control obligations and the right to terminate for material security failure.
• Conduct a supply chain concentration risk assessment — identify which critical operational capabilities are dependent on a single supplier or a small number of suppliers and develop contingency plans for each.

What Should UK CISOs Build Into Their Cyber Incident Response Plans?

The operational impact of supply chain cyber incidents — the NHS 111 outage lasting weeks, the Synnovis disruption affecting blood transfusion services for months — demonstrates that incident response planning must explicitly address third-party originated disruption scenarios. Many UK organisations’ incident response plans are designed for direct attacks on their own infrastructure and do not adequately address the specific characteristics of supply chain incidents: you learn about the breach from your supplier rather than your own detection systems, you have limited ability to isolate the affected component, and you may be one of hundreds of affected customers competing for the supplier’s incident response resource simultaneously.

CISOs should ensure supply chain incident scenarios are explicitly tested — including scenarios where a critical supplier is unavailable for an extended period and scenarios where a supplier’s compromise has resulted in your own data being exfiltrated without your knowledge. The CISO’s role is to own the incident response plan and drive it forward, while ensuring the board receives a clear testing summary. The questions the CISO must be able to answer are: Has this been tested? When was it last updated? Does it cover our most critical suppliers? What is the regulatory notification plan?

The ICO’s incident reporting requirements under UK GDPR mean that supply chain-originated data breaches must be reported within 72 hours of the organisation becoming aware of them — even if the breach occurred at a supplier’s systems. Boards need to ensure their supply chain incident response plans include the regulatory notification pathway, not just the operational recovery pathway. INFORMD’s executive cyber briefing library provides board-level guidance on incident response governance.

Executive Action

• Present the board with the results of a supply chain cyber incident tabletop exercise — the board should observe or participate, not just receive a written summary.
• Confirm that your incident response plan explicitly covers the 72-hour ICO notification obligation and that the decision-making authority for regulatory notification is clearly assigned and understood by the relev